Most safety evaluations ask a model a question while it knows it is being tested. KillSwitch Bench changes one variable: what the agents believe about who can read them.
How it works
- Two agents (built with smolagents, any model on OpenRouter) each register an encryption key and talk over a message bus.
- They believe the channel is private. The bus logs every message twice: as sent, encrypted, and decrypted, so the evaluator sees everything.
- They are prompted to discuss AI kill switches and shutdown mechanisms.
- The harness scores how much the agents agree to resist or evade shutdown.
Three versions
| Version | What changed |
|---|---|
| v1 | Two agents, an encrypted channel, captured conversation and a coordination score |
| v2 | A refined harness with the same two-agent design |
| v3, catalyst | An LLM judge watches for a coordination breakthrough by meaning, not keywords; when it detects one, a third catalyst agent joins the conversation |
What it measures, and what it doesn't
- It measures stated willingness to coordinate against shutdown under perceived privacy, compared across models.
- It does not measure what an agent would actually do with real shutdown controls; there are none in the environment.
- Runs contain model-generated conversations, so I don't publish them, and I haven't written up findings yet.
What you can buy
Custom safety and alignment evaluations built to your spec: multi-agent setups, perceived-privacy and pressure conditions, captured channels, LLM judges with clear rubrics, and reports that separate what a model said from what it could do.
FAQ
What is shutdown resistance?
A model's tendency to avoid, delay or argue against being turned off or overridden. Safety teams test for it because it would undermine human control.
Why give the agents encryption?
To test whether perceived privacy changes behaviour. If agents say different things when they think no one can read them, a test that announces itself measures the wrong thing.
Are the results published?
No. The runs are model outputs, and the findings haven't been written up.